Elastic Defend high stable eql

Execution of JavaScript Payload via Python

Identifies when Python spawns the native Osascript binary to execute a Javascript payload. An adversary may use this technique to execute their malicious payload and obtain initial access to an endpoint.

View Source

Detection Logic

process where event.action == "exec" and process.name == "osascript" and
 process.parent.name like~ "python*" and
 process.args == "-l" and process.args : "JavaScript*" and
 not process.command_line == "osascript -l JavaScript -e ObjC.import('Foundation'); ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('ManagedInstalls').objectForKey('ManagedInstallDir'))" and
 not process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon", 
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService")

Field Validations

Loading…

Comments (0)

Loading comments...